1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
%( CONFIG_GENERIC_SIGALTSTACK == "n" || kernel_v < "3.8" %?
# sigaltstack ________________________________________________
# int sys_sigaltstack(unsigned long ebx)
#
# NOTE: args vary between archs.
#
@define _SYSCALL_SIGALTSTACK_NAME
%(
name = "sigaltstack"
%)
@define _SYSCALL_SIGALTSTACK_ARGSTR
%(
argstr = sprintf("%s, %p", uss_str, uoss_uaddr)
%)
probe syscall.sigaltstack = dw_syscall.sigaltstack !, nd_syscall.sigaltstack {}
probe syscall.sigaltstack.return = dw_syscall.sigaltstack.return !,
nd_syscall.sigaltstack.return {}
# dw_sigaltstack _____________________________________________________
probe dw_syscall.sigaltstack = kernel.function("sys_sigaltstack")
{
@_SYSCALL_SIGALTSTACK_NAME
# 'ussp' should have been 'uss_uaddr. Deprecate the old name.
%(systemtap_v <= "1.4" %?
ussp = %( kernel_vr < "2.6.25" %? $ebx %: %( kernel_vr < "2.6.30" %? $bx %: $regs->bx %) %)
%)
if (@defined($regs)) {
uss_uaddr = @choose_defined($uss, $regs->bx)
uoss_uaddr = @choose_defined($uoss, $regs->cx)
%(systemtap_v < "2.3" %?
regs = $regs
%)
}
else if (@defined($bx)) { # kernels < "2.6.30"
uss_uaddr = $bx
# Make sure the register value didn't get sign extended.
uoss_uaddr = __ulong(@cast(&$bx, "pt_regs", "kernel<asm/ptrace.h>")->cx)
%(systemtap_v < "2.3" %?
regs = &$bx
%)
}
else { # kernels < "2.6.25"
uss_uaddr = $ebx
# Make sure the register value didn't get sign extended.
uoss_uaddr = __ulong(@cast(&$ebx, "pt_regs", "kernel<asm/ptrace.h>")->ecx)
%(systemtap_v < "2.3" %?
regs = &$ebx
%)
}
uss_str = _stp_sigaltstack_u(uss_uaddr)
@_SYSCALL_SIGALTSTACK_ARGSTR
}
probe dw_syscall.sigaltstack.return = kernel.function("sys_sigaltstack").return
{
@_SYSCALL_SIGALTSTACK_NAME
@SYSC_RETVALSTR($return)
}
# nd_sigaltstack _____________________________________________________
probe nd_syscall.sigaltstack = kprobe.function("sys_sigaltstack")
{
@_SYSCALL_SIGALTSTACK_NAME
asmlinkage()
// Sigh, it doesn't seem possible to get the address of regs
// here without dipping down into deep mojo.
__regs = __ulong(register("esp")) + 4
uss_uaddr = __ulong(@choose_defined(@cast(__regs, "pt_regs", "kernel<asm/ptrace.h>")->bx,
@cast(__regs, "pt_regs", "kernel<asm/ptrace.h>")->ebx))
%(systemtap_v <= "1.4" %?
ussp = uss_uaddr
%)
uoss_uaddr = __ulong(@choose_defined(@cast(__regs, "pt_regs", "kernel<asm/ptrace.h>")->cx,
@cast(__regs, "pt_regs", "kernel<asm/ptrace.h>")->ecx))
uss_str = _stp_sigaltstack_u(uss_uaddr)
@_SYSCALL_SIGALTSTACK_ARGSTR
}
probe nd_syscall.sigaltstack.return = kprobe.function("sys_sigaltstack").return
{
@_SYSCALL_SIGALTSTACK_NAME
@SYSC_RETVALSTR(returnval())
}
%)
|
